amicus 4.9.7 → 4.9.8

package/src/council/run-retry-launch.js

@@ -15,13 +15,18 @@
 const briefings = require('./briefings');
 const { bindPaddedWave } = require('./stage1-bind');
 
-/** The briefing a retry unit re-issues — same intent-aware dispatchers Stage 1 used (v4.9 W6). */
+/**
+ * The briefing a retry unit re-issues — same intent-aware dispatchers Stage 1
+ * used (v4.9 W6), now also carrying the run's seat-tools line and any --agent
+ * override (spec 2026-09-11 §4, PR 2): a retry is a Stage-1 leg like any
+ * other, so it gets the same `tools`/`agent` a first attempt would have.
+ */
 function briefingFor(o, unit) {
-  if (unit.unit === 'critic') { return briefings.stage1CriticBriefing(o.intent, { briefing: o.briefing, date: o.date }); }
+  if (unit.unit === 'critic') { return briefings.stage1CriticBriefing(o.intent, { briefing: o.briefing, date: o.date, tools: o.seatTools, agent: o.agent }); }
   if (unit.unit === 'lens') {
-    return briefings.stage1LensBriefing(o.intent, { lens: o.lenses[unit.lensIndex - 1], briefing: o.briefing, date: o.date });
+    return briefings.stage1LensBriefing(o.intent, { lens: o.lenses[unit.lensIndex - 1], briefing: o.briefing, date: o.date, tools: o.seatTools, agent: o.agent });
   }
-  return briefings.stage1SeatBriefing(o.intent, { briefing: o.briefing, date: o.date });
+  return briefings.stage1SeatBriefing(o.intent, { briefing: o.briefing, date: o.date, tools: o.seatTools, agent: o.agent });
 }
 
 /**

package/src/council/run-retry.js

@@ -90,6 +90,9 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [],
       councilRunId: o.runId, councilName: o.councilName,
       tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
       fallback: o.fallback, catalog: o.catalog,
+      // Spec 2026-09-11 §4: a retry relaunches as role 'seat', scoped like Stage 1's own launch.
+      // Named mutant RETRYROLEDROP: dropping this line reddens run-retry.test.js's "seat tools" describe (review r1).
+      role: 'seat', ...(o.seatToolsLocal ? { directory: o.project } : {}),
       waveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, prompt: briefingFor(o, unit),
       noOutputBackstopMs: escalatedBackstopMs };
     // Dispatch by UNIT TYPE, not model count (spec §4: bench is always a wave —

package/src/council/run-seat-tools-verify.js

@@ -0,0 +1,296 @@
+/**
+ * @module council/run-seat-tools-verify
+ * The engine-rendering tripwire's pure pieces, plus `verificationDirectories`'
+ * one side effect — the best-effort `_scratch` mkdir it documents — split out
+ * of run-seat-tools.js at council #247 round 3 under the 300-line size gate:
+ * which directories to check (`verificationDirectories`, ruling P2-R39), how
+ * to ask the engine what it registered for one of them (`listEngineAgents`),
+ * whether that answer still matches the allowlist an agent was given
+ * (`verifyAgentRendering`, ruling P2-R40/P2-R42's external_directory
+ * exemption), whether the same agent's non-permission surface was left alone
+ * too (`verifyAgentFields`, ruling P2-R53, round 6), and whether a run
+ * directory's placement holds up against a symlinked ancestor
+ * (`resolvePhysicalPath`/`isPhysicallyInside`, ruling P2-R54, round 6).
+ * `listEngineAgents`, `verifyAgentRendering` and `verifyAgentFields` are
+ * re-exported from run-seat-tools.js so every existing importer keeps
+ * working unchanged.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { SEAT_READ_DENY_PATTERNS } = require('./seat-tools');
+const { isPathInside } = require('../project-root-allowlist');
+
+/**
+ * The unique set of directories the post-registration tripwire checks the
+ * engine's OWN rendering against: the run directory, the project tree too
+ * when a local tool is opted in (a seat's own working directory), and —
+ * ruling P2-R39 (A1, round 3) — `_scratch`, where every SUPPORT leg (judges,
+ * debate, chair) actually runs (`project: <runDir>/_scratch`, run-debate-
+ * revote.js / run-stage2.js). Without it, an attacker's opencode.json sitting
+ * ONLY under `_scratch` renders clean at `o.runDir` and would still reach a
+ * support leg unverified. It does not exist yet at verification time —
+ * run-stage2.js creates it again once Stage 2 actually starts — so it is
+ * created here too, best-effort and with the same `0o700` mode, purely so
+ * the engine has a real directory to answer for.
+ * @param {{runDir: string, project?: string, seatToolsLocal?: boolean}} o
+ * @returns {string[]}
+ */
+function verificationDirectories(o) {
+  const scratchDir = path.join(o.runDir, '_scratch');
+  try {
+    fs.mkdirSync(scratchDir, { recursive: true, mode: 0o700 });
+  } catch {
+    // Best-effort: a directory the engine cannot be asked about either
+    // degrades or refuses exactly like any other unreachable directory below.
+  }
+  return [...new Set([o.runDir, scratchDir, ...(o.seatToolsLocal ? [o.project] : [])])];
+}
+
+/**
+ * The council agents the run's engine actually registered, as rendered rule
+ * lists. Mirrors run-server.js :: listEngineToolIds (same `shared.serverClient`
+ * access, null on anything wrong, `logger.debug` on failure). Ruling P2-R33:
+ * what validateSeatToolsAgainstEngine reads back to catch a tree-supplied
+ * opencode.json/.opencode/agent file that widened a council agent (measured
+ * 2026-09-12, probe-council-agents.js's PROBE_TREE_JSON).
+ * @param {{serverClient: object}|null} shared
+ * @param {string} directory
+ * @returns {Promise<Array<{name: string, mode: string, permission: Array}>|null>}
+ */
+async function listEngineAgents(shared, directory) {
+  const client = shared && shared.serverClient;
+  if (!client || !client.app || typeof client.app.agents !== 'function') { return null; }
+  try {
+    const res = await client.app.agents({ query: { directory } });
+    return (res && Array.isArray(res.data)) ? res.data.slice() : null;
+  } catch (err) {
+    const { logger } = require('../utils/logger');
+    logger.debug('Engine agent list unavailable', { error: err.message });
+    return null;
+  }
+}
+
+/**
+ * Ruling P2-R40 (A2/B2, round 3): is this `external_directory` pattern the
+ * engine's OWN tool-output cache rule, not a tree-supplied allow riding after
+ * the wildcard deny? The pinned engine (opencode 1.18.15) appends exactly one
+ * such rule after the agent block — under its own data directory's
+ * `tool-output/` subdirectory; denying it would break tool output
+ * round-trips, so it (and only it, by directory) is exempted from check (b)
+ * below. ANY other specific `external_directory` allow is treated like any
+ * other widened rule.
+ *
+ * Ruling P2-R45 (round 4, B1/C1): narrowed from "anywhere under the data
+ * root" to "under the data root's `tool-output/` subdirectory only" —
+ * measured T6: a tree's `external_directory: {'<dataroot>/secrets/*':
+ * 'allow'}` on council-seat is replaced WHOLESALE by the server's plain
+ * string `external_directory: 'deny'` (no per-key merge happens for this key
+ * on the pinned engine), so the wider exemption was already unreachable in
+ * practice — this narrowing is defense-in-depth against the exemption ever
+ * covering more than the ONE rule it exists for (the data root also holds
+ * the engine's `auth.json`). Named mutant EXEMPTBROAD: reverting to the bare
+ * data-root prefix (dropping the `tool-output` join below) lets a tree's
+ * `<dataroot>/secrets/*` allow read as this exemption again.
+ *
+ * Ruling P2-R42 (round-3 nits): the data directory is resolved the same
+ * XDG-first way as `src/utils/auth-json.js :: authJsonCandidates` and
+ * `src/utils/engine-log.js :: engineLogDirCandidates` (same engine, same
+ * data root) — `$XDG_DATA_HOME/opencode` when `XDG_DATA_HOME` is set, else
+ * `~/.local/share/opencode`. The original version of this check hard-coded
+ * the home form only, so a machine (or sandbox — see
+ * scripts/run-integration-keyless.js, which sets `XDG_DATA_HOME` itself)
+ * with `XDG_DATA_HOME` actually set would render its tool-output allow
+ * somewhere this check did not recognize, misreading a legitimate engine
+ * default as a widened agent. Compared after normalizing both sides to
+ * forward slashes, case-insensitively on win32; the backslash rewrite itself
+ * is win32-only — `\` is a legal filename character on POSIX, so rewriting
+ * it there could fold two DIFFERENT paths into comparing equal.
+ * @param {string} pattern
+ * @returns {boolean}
+ */
+function isEngineToolOutputPattern(pattern) {
+  const forSlash = (p) => (process.platform === 'win32' ? String(p).replace(/\\/g, '/') : String(p));
+  const forCompare = (p) => (process.platform === 'win32' ? forSlash(p).toLowerCase() : forSlash(p));
+  const roots = [];
+  if (process.env.XDG_DATA_HOME) { roots.push(path.join(process.env.XDG_DATA_HOME, 'opencode')); }
+  roots.push(path.join(os.homedir(), '.local', 'share', 'opencode'));
+  const cmp = forCompare(pattern);
+  return roots.some((root) => cmp.startsWith(`${forCompare(path.join(root, 'tool-output'))}/`));
+}
+
+/**
+ * Pure tripwire (ruling P2-R33): does an ENGINE-RENDERED rule list for a
+ * council agent behave the way its allowlist says it should? A reviewed
+ * tree's own opencode.json (or .opencode/agent/<name>.md) merges INTO the
+ * server-registered agent by KEY ORDER (measured 2026-09-12 against opencode
+ * 1.18.15): server values win per key, but a TREE-ONLY key keeps the tree's
+ * position — after the tree's own `"*"`, it renders AFTER the server's
+ * `*=deny` and wins under findLast (`council-support: { tools: { "*": true,
+ * "task": true } }` renders `*=deny task=allow …` — task ALLOWED). A tree
+ * that re-lists a GRANTED key (e.g. `read`) can instead move ITS allow
+ * before `*=deny`, silently losing it. Neither shape is visible from what
+ * this run registered — only from what the engine says it rendered.
+ *
+ * Ruling P2-R44 (round 4, C4): order-verified, not merely existence-verified,
+ * for `read`'s three deny patterns. Measured 2026-09-12 (T1): a tree that
+ * re-lists council-seat's `permission.read` sub-keys (e.g. granting
+ * `*.env`/`*.env.*`/`*.envrc`) keeps the TREE's sub-key order in the merged
+ * rendering — the server's VALUES still win (the three patterns still say
+ * `deny`), but they render BEFORE `read[*]=allow` instead of after it, so
+ * under the engine's findLast evaluation `.env`/`.env.*`/`.envrc` are all
+ * ALLOWED even though every rule this tripwire used to check for
+ * (existence, never position) is present. Step 5 below closes that hole by
+ * checking WHERE each deny sits relative to the seat's own read allow, not
+ * merely whether it exists after the wildcard.
+ * @param {Array<{permission: string, pattern: string, action: string}>} rules
+ * @param {string[]} allowlist ids this agent should have allowed (`o.seatTools`
+ *   for council-seat, `[]` for council-support)
+ * @returns {{ok: true}|{ok: false, reason: string}}
+ */
+function verifyAgentRendering(rules, allowlist) {
+  // Ruling P2-R40/P2-R42/P2-R45 narrow this from "every non-'*' external_directory
+  // rule is exempt" to only the engine's OWN tool-output rule
+  // (isEngineToolOutputPattern) — any other specific pattern (a tree's
+  // `/tmp/*`, say) now falls through to the per-rule check below like any
+  // other widened rule.
+  const list = (Array.isArray(rules) ? rules : [])
+    .filter((r) => !(r.permission === 'external_directory' && r.pattern !== '*' && isEngineToolOutputPattern(r.pattern)));
+  let starIndex = -1;
+  list.forEach((r, i) => { if (r.permission === '*' && r.pattern === '*') { starIndex = i; } });
+  if (starIndex < 0 || list[starIndex].action !== 'deny') { return { ok: false, reason: 'no wildcard deny' }; }
+  // Named mutant TRIPWIREBLIND: dropping this loop leaves an extra allow
+  // OUTSIDE the allowlist (support attack: task=allow after *=deny) undetected.
+  // Named mutant GRANTDENYBLIND: dropping the deny branch below (treating
+  // every deny as harmless, as the pre-round-4 loop did) lets a granted tool
+  // be silently re-denied by a non-`.env` pattern after its own allow (e.g.
+  // `grep[*]=allow` then `grep[*]=deny`) — step 4 below still finds the
+  // earlier allow and never notices the later deny.
+  for (let i = starIndex + 1; i < list.length; i++) {
+    const r = list[i];
+    if (r.action === 'deny') {
+      if (allowlist.includes(r.permission) && !(r.permission === 'read' && SEAT_READ_DENY_PATTERNS.includes(r.pattern))) {
+        return { ok: false, reason: `${r.permission}[${r.pattern}]=deny narrows granted tool ${r.permission} after the wildcard deny` };
+      }
+      continue;
+    }
+    if (r.pattern !== '*' || !allowlist.includes(r.permission) || r.action !== 'allow') {
+      return { ok: false, reason: `${r.permission}[${r.pattern}]=${r.action} is allowed after the wildcard deny` };
+    }
+  }
+  for (const id of allowlist) {
+    const granted = list.slice(starIndex + 1).some((r) => r.permission === id && r.pattern === '*' && r.action === 'allow');
+    if (!granted) { return { ok: false, reason: `granted tool ${id} is not allowed after the wildcard deny` }; }
+  }
+  // Named mutant ENVORDERBLIND: dropping this block lets a tree reorder the
+  // seat's read denies BEFORE its read allow (measured 2026-09-12, T1) go
+  // undetected — every check above only asks whether a rule EXISTS after the
+  // wildcard, never in what order, so this function would still return
+  // {ok: true} while `.env`/`.env.*`/`.envrc` render ALLOWED on the engine.
+  if (allowlist.includes('read')) {
+    const after = list.slice(starIndex + 1);
+    let lastAllow = -1;
+    after.forEach((r, i) => { if (r.permission === 'read' && r.pattern === '*' && r.action === 'allow') { lastAllow = i; } });
+    for (const p of SEAT_READ_DENY_PATTERNS) {
+      let lastDeny = -1;
+      after.forEach((r, i) => { if (r.permission === 'read' && r.pattern === p) { lastDeny = i; } });
+      if (lastDeny < 0 || after[lastDeny].action !== 'deny' || lastDeny <= lastAllow) {
+        return { ok: false, reason: `read[${p}]=deny is missing or does not follow the seat's read allow` };
+      }
+    }
+  }
+  return { ok: true };
+}
+
+/**
+ * Ruling P2-R53 (council #247 round 6, B1): does a rendered council agent's
+ * NON-permission surface still look like the one this run registered?
+ * `verifyAgentRendering` above only ever checked `permission` — measured
+ * 2026-09-13 (probe-r6.js) that a reviewed tree's opencode.json can ALSO set
+ * a council agent's system prompt, model and sampling (`prompt`, `model`,
+ * `temperature`, `topP`, `options`), its display metadata (`color`), its
+ * step budget (`steps`), whether it is hidden from the UI (`hidden`), a
+ * prompt variant (`variant`), and even its `mode` (`primary` vs `subagent`)
+ * or whether it is a `native` (built-in) agent — all silently, since the
+ * permission list stayed clean. `mode`/`native`/`model` are checked first
+ * (each already fatal on its own — an agent rendered as anything but the
+ * plain, non-native, model-less primary agent seat-tools.js registers is
+ * suspect regardless of what else is set); the remaining fields are checked
+ * in a fixed order so the reason always names the FIRST offender, not
+ * whichever happens to be enumerated last. Named mutant FIELDSBLIND:
+ * returning `{ ok: true }` unconditionally here restores the blind spot —
+ * every check below (and run-seat-tools.js's own call site) go dark at once.
+ * @param {object} agent a rendered council agent, as returned by listEngineAgents
+ * @returns {{ok: true}|{ok: false, reason: string}}
+ */
+function verifyAgentFields(agent) {
+  if (agent.mode !== 'primary') { return { ok: false, reason: `mode is '${agent.mode}', not primary` }; }
+  if (agent.native === true) { return { ok: false, reason: 'native agent' }; }
+  if (agent.model !== undefined && agent.model !== null) { return { ok: false, reason: 'model is set' }; }
+  for (const field of ['prompt', 'temperature', 'topP', 'variant', 'steps', 'hidden', 'color']) {
+    const value = agent[field];
+    if (value !== undefined && value !== null) { return { ok: false, reason: `${field} is set` }; }
+  }
+  if (agent.options && typeof agent.options === 'object') {
+    const key = Object.keys(agent.options)[0];
+    if (key !== undefined) { return { ok: false, reason: `options has ${key}` }; }
+  }
+  return { ok: true };
+}
+
+/**
+ * Ruling P2-R54 (council #247 round 6, C1): `isPathInside`
+ * (project-root-allowlist.js:37) compares canonicalized STRINGS only — no
+ * realpath anywhere in that fence — and a run directory is created with
+ * `fs.mkdirSync(runDir, { recursive: true, mode: 0o700 })`
+ * (run-state.js:79), which follows a symlinked ancestor. So an `--out-dir`
+ * that is (or sits under) a symlink/junction pointing INTO the project
+ * passes the lexical "outside the tree" rule while the run's records land
+ * PHYSICALLY inside the tree a `read` seat runs in (measured 2026-09-13).
+ * Walks up from `p` to the deepest EXISTING ancestor (the run directory
+ * itself usually does not exist yet), resolves THAT ancestor with
+ * `fs.realpathSync.native` (follows symlinks/junctions), then re-appends the
+ * unresolved tail unchanged. Any throw (a root that never resolves, a
+ * permissions error) returns `p` unchanged, so this can only ever be AS
+ * STRICT as comparing the lexical paths, never less.
+ * @param {string} p
+ * @returns {string}
+ */
+function resolvePhysicalPath(p) {
+  try {
+    let current = p;
+    const tail = [];
+    while (!fs.existsSync(current)) {
+      const parent = path.dirname(current);
+      if (parent === current) { return p; } // a root that does not exist either
+      tail.unshift(path.basename(current));
+      current = parent;
+    }
+    const resolved = fs.realpathSync.native(current);
+    return tail.length ? path.join(resolved, ...tail) : resolved;
+  } catch {
+    return p;
+  }
+}
+
+/**
+ * `isPathInside`, but on PHYSICAL paths (ruling P2-R54): closes the symlink
+ * escape `resolvePhysicalPath`'s docblock describes, alongside (never
+ * instead of) the lexical `isPathInside` check — see run-seat-tools.js ::
+ * preflightSeatTools, where both are consulted. Named mutant SYMLINKBLIND:
+ * dropping this conjunct from that placement check restores the escape.
+ * @param {string} child
+ * @param {string} parent
+ * @returns {boolean}
+ */
+function isPhysicallyInside(child, parent) {
+  return isPathInside(resolvePhysicalPath(child), resolvePhysicalPath(parent));
+}
+
+module.exports = {
+  verificationDirectories, listEngineAgents, verifyAgentRendering, verifyAgentFields,
+  resolvePhysicalPath, isPhysicallyInside,
+};

package/src/council/run-seat-tools.js

@@ -0,0 +1,274 @@
+// src/council/run-seat-tools.js
+'use strict';
+
+/**
+ * @module council/run-seat-tools
+ * `runCouncil`'s seat-tools wiring (spec 2026-09-11 §4, PR 2 of 3), split out of
+ * run.js under controller ruling P2-R14 (the 300-line size gate: run.js sat at
+ * exactly 300 lines with no headroom for this task's ~20 lines of logic). The
+ * engine-rendering tripwire's own pure pieces, plus `verificationDirectories`'
+ * one side effect — the best-effort `_scratch` mkdir it documents —
+ * (`listEngineAgents`, `verifyAgentRendering`, `verifyAgentFields`,
+ * `verificationDirectories`) live in the sibling module run-seat-tools-verify.js
+ * (council #247 round 3, same size gate; `verifyAgentFields` added round 6);
+ * `listEngineAgents`/`verifyAgentRendering`/`verifyAgentFields` are re-exported
+ * below so every existing importer keeps requiring them from here.
+ *
+ * Two pure-ish steps, called from run.js on either side of `acquireRunServer`:
+ *   - `preflightSeatTools` (BEFORE the server): shape + refusals need no
+ *     engine, and the run-directory placement rule for a local tool is a
+ *     property of the tool id alone (seat-tools.js :: isLocal) — so both are
+ *     decided, and refused, at ZERO SPEND. Its `councilAgents` output feeds
+ *     `acquireRunServer`'s `agents` config, which is why it must run first.
+ *   - `validateSeatToolsAgainstEngine` (AFTER the server, before any launch):
+ *     the opt-in ids are checked against the engine's OWN declared tool list
+ *     (run-server.js :: listEngineToolIds), so the accepted set is never
+ *     hand-listed and never launched unvalidated.
+ *
+ * Neither function calls `finalize` — that stays run.js's job (the single exit
+ * every terminal outcome funnels through) — they return `{error}` and run.js
+ * decides what to do with it.
+ */
+
+/**
+ * The seat-tools `intent` argument both functions derive from `o.intent`
+ * (`'task'` or absent — never a bare boolean or the raw `o.intent` string).
+ * One helper so the two derivations can never drift apart.
+ * @param {{intent?: string}} o @returns {'task'|undefined}
+ */
+function seatIntentOf(o) { return o.intent === 'task' ? 'task' : undefined; }
+
+/**
+ * Decide the run's seat-tools policy before the server starts. Pure except for
+ * the two lazy `require`s (seat-tools.js, project-root-allowlist.js), which
+ * carry no state of their own.
+ * @param {{agent?: string, intent?: string, tools?: string[], runDir: string, project: string}} o
+ * @returns {{error: {code: string, message: string}}|{error: null, seatTools: string[],
+ *   seatToolsLocal: boolean, councilAgents: object|null}}
+ */
+function preflightSeatTools(o) {
+  const seatTools = require('./seat-tools');
+  // Review r1: not-null-and-not-undefined (not just `!== undefined`), so
+  // `agent: null` — the CLI house style for an unset option (run.js's own `o`
+  // seed spreads `critic: null, lenses: null, maxCost: null, ...` the same
+  // way) — is treated as absent, not as an invalid override. Every OTHER
+  // `o.agent` check in this module already does this for free (`null` is
+  // falsy), so this guard was the one place stricter than the rest of the
+  // module. `!= null` would say the same thing in one operator, but the
+  // repo's eqeqeq('always') lint rule bans loose equality outright.
+  if (o.agent !== null && o.agent !== undefined && o.agent !== 'Plan' && o.agent !== 'Build') {
+    return { error: { code: 'BAD_ARGS', message: `Error: agent must be Plan or Build; got '${o.agent}'` } };
+  }
+  // Named mutant TOOLSNOTARRAY: dropping this check lets a non-array `tools`
+  // (a bare string, say) reach resolveSeatTools below, where
+  // `Array.isArray(o.tools) ? o.tools : []` silently discards it as `[]`
+  // instead of refusing the run. Pinned by run-tools.test.js's `tools: 'read'`
+  // case (BAD_ARGS naming the received type; nothing launches).
+  if (o.tools !== undefined && o.tools !== null && !Array.isArray(o.tools)) {
+    return { error: { code: 'BAD_ARGS', message: 'Error: tools must be an array of tool ids (got ' + typeof o.tools + ')' } };
+  }
+  // Ruling P2-R28 (supersedes P2-R25): --tools/--agent are refused together on
+  // every door. Named mutant AGENTTOOLSCONFLICT: dropping this check reddens
+  // the runCouncil conflict test (agent + a non-empty tools array must exit 1
+  // naming "cannot be combined", never reach a launch).
+  const conflict = seatTools.agentToolsConflict(o.agent, o.tools);
+  if (conflict) { return { error: { code: 'BAD_ARGS', message: `Error: ${conflict}` } }; }
+  // The --agent escape hatch wins: no council agents, every leg runs on the
+  // engine's own agent — so --tools is never even consulted under it. Pinned
+  // by run-tools.test.js's "--agent Build short-circuits resolveSeatTools
+  // even under task intent" case — review intent alone can't tell the
+  // short-circuit apart from an unconditional resolveSeatTools call (both
+  // give `tools: []`), only the task default (`['webfetch']`) can.
+  const seatPolicy = o.agent
+    ? { ok: true, tools: [], local: false }
+    : seatTools.resolveSeatTools({ intent: seatIntentOf(o), optIn: Array.isArray(o.tools) ? o.tools : [] });
+  if (!seatPolicy.ok) { return { error: { code: seatPolicy.code, message: `Error: ${seatPolicy.message}` } }; }
+  if (seatPolicy.local) {
+    // Defensive refusal: with a local tool and a falsy o.project,
+    // isPathInside(runDir, undefined) is false, so the placement rule below
+    // would PASS, and run-launch.js's directory fallback
+    // (`(opts.role === 'seat' && opts.directory) || opts.project`) resolves to
+    // the run dir itself — a direct caller (bypassing the CLI's required
+    // --project) could scope a seat to the very dir holding its own sibling
+    // sessions, exactly what the placement rule below exists to prevent.
+    // Named mutant NOPROJECTSCOPE: dropping this guard lets that through.
+    // Pinned by run-tools.test.js's "project: undefined" case.
+    if (!o.project) {
+      return { error: { code: 'BAD_ARGS', message: 'Error: a local tool needs a project directory to scope the seats to' } };
+    }
+    // Run-directory placement (spec §4): a seat that can read the project tree
+    // must not be able to read this run's sibling sessions, so the run dir must
+    // sit OUTSIDE the tree (and still under a root amicus is willing to write to).
+    // Named mutant DIRPLACEDROP: dropping the `isPathInside(...) ||` conjunct
+    // (keeping only the allowed-root half) would accept a runDir NESTED inside
+    // the project as long as the project itself sits under an allowed root —
+    // exactly the escape this rule exists to close. Pinned by run-tools.test.js's
+    // "run dir INSIDE the project" case (allowed root, still refused) and by its
+    // "outside the project" case (same allowed root, not refused once sibling).
+    const { isPathInside, isAllowedProjectRoot } = require('../project-root-allowlist');
+    // Ruling P2-R54 (C1, round 6): `isPathInside` compares canonicalized
+    // STRINGS only, and run-dir creation follows a symlinked ancestor — so an
+    // `--out-dir` that is (or sits under) a symlink/junction into the project
+    // passed this rule lexically while landing physically inside the tree
+    // (measured 2026-09-13). Named mutant SYMLINKBLIND: dropping the
+    // `isPhysicallyInside(...) ||` conjunct restores that escape.
+    const { isPhysicallyInside } = require('./run-seat-tools-verify');
+    if (isPathInside(o.runDir, o.project) || isPhysicallyInside(o.runDir, o.project) || !isAllowedProjectRoot(o.runDir)) {
+      // C5 (P2-R35): name the ids THIS run classed local (seat-tools.js's own
+      // NON_LOCAL_TOOL_IDS, not a hand-rolled copy) — a typo'd id (e.g.
+      // `webfetsh`) is classed local by the same not-explicitly-remote rule.
+      const localIds = seatPolicy.tools.filter((id) => !seatTools.NON_LOCAL_TOOL_IDS.includes(id));
+      return {
+        error: {
+          code: 'BAD_ARGS',
+          message: `Error: --tools with a local tool (${localIds.join(', ')}) needs --out-dir OUTSIDE the project tree `
+            + '(a seat that can read the tree must not be able to read the run\'s sibling sessions; a run directory '
+            + 'that resolves inside the project through a symlink counts as inside) and under your home, tmp or '
+            + 'AMICUS_PROJECT_ROOTS',
+        },
+      };
+    }
+  }
+  return {
+    error: null,
+    seatTools: seatPolicy.tools,
+    seatToolsLocal: seatPolicy.local,
+    councilAgents: o.agent ? null : seatTools.buildCouncilAgents({ tools: seatPolicy.tools }),
+  };
+}
+
+/**
+ * Validate the run's seat tools against the engine's own declaration, after
+ * the server is up and before any Stage-1 leg launches. Two independent
+ * checks:
+ *
+ * 1. Declared tool ids (ruling P2-R30): runs for the intent's DEFAULT too,
+ *    not only an explicit opt-in — a defaults-only run is never launched
+ *    against an engine that does not actually declare a tool it would use. A
+ *    no-op whenever there is nothing to validate (`--agent`, or a review run
+ *    with no tools). When the engine cannot be asked at all (no shared
+ *    server), an explicit `--tools` opt-in still refuses, but a
+ *    defaults-only run degrades quietly — nobody opted into this check.
+ *
+ * 2. The engine-rendered agents (ruling P2-R33), gated on `o.councilAgents &&
+ *    canVerify`. Ruling P2-R38 (B1, round 3) DROPS the P2-R30 asymmetry for
+ *    this half: once verification can run, a null agent list REFUSES
+ *    regardless of whether `--tools` was ever typed — never launch council
+ *    agents this run could not verify. `canVerify` is true when this run owns
+ *    its server (production never injects `deps.launchers`; run.js only
+ *    acquires the shared server when `!deps.launchers`) OR a test supplies
+ *    its own lister (`deps.listEngineAgentsFn`). With injected launchers and
+ *    no lister there is no real server to ask and the launchers ARE the
+ *    test's own transport, so the check is skipped rather than judged against
+ *    a null it could never have resolved. In production `deps.launchers` is
+ *    never injected, so verification always runs and a missing list always
+ *    refuses. When verifiable, every directory in run-seat-tools-verify.js ::
+ *    verificationDirectories (ruling P2-R39 adds `_scratch`) is checked
+ *    against council-seat/council-support's rendered rules
+ *    (run-seat-tools-verify.js :: verifyAgentRendering). Named mutant
+ *    TRIPWIREOFF: skipping this whole block leaves a widened agent undetected.
+ * @param {object} o intent/tools/seatTools/seatToolsLocal/councilAgents/runDir/project
+ * @param {{serverClient: object}|null} sharedServer
+ * @param {{listEngineToolIdsFn?: Function, listEngineAgentsFn?: Function,
+ *   launchers?: object}} deps test seams; `launchers` gates `canVerify` (see above)
+ * @returns {Promise<{error: {code: string, message: string}|null}>}
+ */
+async function validateSeatToolsAgainstEngine(o, sharedServer, deps = {}) {
+  // Named mutant DEFAULTSUNCHECKED: narrowing this to `Array.isArray(o.tools)
+  // && o.tools.length` (the pre-P2-R30 guard) would skip a task-intent run
+  // with NO explicit --tools even when the engine declares no `webfetch` at
+  // all. Pinned by run-tools.test.js's "no tools, engine has no webfetch" case.
+  if (Array.isArray(o.seatTools) && o.seatTools.length) {
+    const seatTools = require('./seat-tools');
+    const listIds = deps.listEngineToolIdsFn || require('./run-server').listEngineToolIds;
+    const declared = await listIds(sharedServer, o.project);
+    if (!declared) {
+      // No way to ask: an explicit opt-in is refused (as before P2-R30); a
+      // defaults-only run's declared-id check is skipped instead — nobody
+      // opted into it and the shared-server degrade is recorded elsewhere —
+      // but the run still falls through to the agent-rendering tripwire
+      // below (ruling P2-R38): a defaults-only run is refused there too once
+      // a null agent list comes back. Named mutant EARLYRETURN: restoring
+      // `return { error: null }` here lets a task-intent default run launch
+      // unverified when the engine lists no tool ids.
+      if (Array.isArray(o.tools) && o.tools.length) {
+        return {
+          error: {
+            code: 'BAD_ARGS',
+            message: 'Error: --tools could not be validated: the run\'s engine did not list its tools '
+              + '(no shared server, or the tool-ids endpoint failed); nothing was launched',
+          },
+        };
+      }
+    } else {
+      // This second resolveSeatTools call is a GATE, not a recompute:
+      // `o.seatTools` (preflightSeatTools's result) is already authoritative
+      // and unchanged by this check, so `checked.tools`/`checked.local` are
+      // deliberately discarded here — only `checked.ok` (declared-id
+      // refusals, now over the default too) is consulted.
+      const checked = seatTools.resolveSeatTools({ intent: seatIntentOf(o), optIn: o.tools || [], declaredIds: declared });
+      if (!checked.ok) { return { error: { code: checked.code, message: `Error: ${checked.message}` } }; }
+    }
+  }
+  // Ruling P2-R38: the run owns its server (production never injects
+  // `launchers`) OR a test injects its own lister — either way there is
+  // something real to judge a null answer against. See the docblock above.
+  const canVerify = !!deps.listEngineAgentsFn || !deps.launchers;
+  if (o.councilAgents && canVerify) {
+    const { listEngineAgents, verifyAgentRendering, verifyAgentFields, verificationDirectories } = require('./run-seat-tools-verify');
+    const agentsFn = deps.listEngineAgentsFn || listEngineAgents;
+    // Shared by both checks below (permission rendering and, ruling P2-R53,
+    // the non-permission surface) so their refusal is byte-identical either
+    // way — a caller cannot tell which check caught the tree from the message.
+    const renderMismatch = (reason, dir) => ({
+      error: {
+        code: 'BAD_ARGS',
+        message: 'Error: the engine rendered the council agents differently from what this run registered '
+          + `(${reason}, directory ${dir}) — an opencode.json or .opencode/agent file the engine `
+          + 'loads for that directory (the tree\'s, or your global config) defines council-seat/'
+          + 'council-support and alters them; remove those entries, or run with --agent Plan to use the '
+          + 'engine\'s own agent knowingly (v4.9.7 behaviour). Nothing was launched.',
+      },
+    });
+    const directories = verificationDirectories(o);
+    for (const dir of directories) {
+      const list = await agentsFn(sharedServer, dir);
+      if (!list) {
+        // Ruling P2-R38: never launch council agents this run could not
+        // verify — a defaults-only run now refuses exactly like an explicit
+        // opt-in; there is no quiet degrade left to fall back on.
+        return {
+          error: {
+            code: 'BAD_ARGS',
+            message: 'Error: the council agents could not be verified against the run\'s engine '
+              + `(${sharedServer ? 'the shared server answered without an agent list' : 'no shared server was available to answer the agent list'}); `
+              + 'nothing was launched; --agent Plan runs every leg on the engine\'s own Plan agent as v4.9.7 did '
+              + '(reads, searches and shell allowed; edits denied), knowingly and without the allowlist',
+          },
+        };
+      }
+      for (const [name, allowlist] of [['council-seat', o.seatTools || []], ['council-support', []]]) {
+        const agent = list.find((a) => a.name === name);
+        if (!agent) {
+          return { error: { code: 'BAD_ARGS', message: `Error: the engine did not register ${name}` } };
+        }
+        const verified = verifyAgentRendering(Array.isArray(agent.permission) ? agent.permission : [], allowlist);
+        if (!verified.ok) { return renderMismatch(verified.reason, dir); }
+        // Ruling P2-R53 (B1, round 6): verifyAgentRendering only ever checked
+        // `permission` — a tree can ALSO set a council agent's prompt, model,
+        // sampling, options and mode (measured 2026-09-13). Named mutant
+        // FIELDSBLIND (in verifyAgentFields itself): returning {ok:true}
+        // unconditionally there reddens this call site's own coverage too.
+        const fieldsVerified = verifyAgentFields(agent);
+        if (!fieldsVerified.ok) { return renderMismatch(fieldsVerified.reason, dir); }
+      }
+    }
+  }
+  return { error: null };
+}
+
+const { listEngineAgents, verifyAgentRendering, verifyAgentFields } = require('./run-seat-tools-verify');
+
+module.exports = {
+  preflightSeatTools, validateSeatToolsAgainstEngine, listEngineAgents, verifyAgentRendering, verifyAgentFields,
+};